Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

INTERPOL's Operation Serengeti III: 1,462 Arrests, 10,909 Criminal Networks Disrupted

A 21-country crackdown coordinated by INTERPOL arrested 1,462 suspects, disrupted 10,909 malicious networks and recovered $105M+ tied to phishing, BEC and investment fraud. Here's what it means for defenders.

4T4Tify Team4Tify
Oct 22, 2026·5 min read
INTERPOL's Operation Serengeti III: 1,462 Arrests, 10,909 Criminal Networks Disrupted

INTERPOL's Operation Serengeti III: 1,462 Arrests and 10,909 Criminal Networks Taken Down

A two-month, multinational law enforcement push coordinated by INTERPOL has ended with 1,462 suspects in custody, 10,909 malicious networks disrupted and more than $105 million in illicit funds recovered. Codenamed Operation Serengeti III, the action ran from June 29 to August 31, 2026 and was announced on Thursday, October 22.

What happened

Police and investigators from 21 countries took part, most of them across Africa, alongside the United States: Angola, Benin, Cameroon, Congo, Côte d'Ivoire, the Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, the United States, Zambia and Zimbabwe.

INTERPOL says the networks it went after had targeted 65,929 identified victims, and financial investigators tied the activity to losses of over $385 million. Private-sector threat intelligence played a central role: Group-IB and Team Cymru were among the partners supplying data on phishing kits, botnets and other malicious infrastructure hosted in, or aimed at, the region.

Among the operational results INTERPOL highlighted:

  • Uganda: two transnational fraud rings broken up and 365 foreign nationals arrested over online investment and pension scams aimed at victims in Asia.
  • Angola: two illegal crypto-mining centres dismantled, nine arrests, and around 2,000 mining rigs plus six illegal power transformation stations — valued at more than $1 million — seized.
  • Nigeria: one arrest tied to a large phishing and business email compromise (BEC) operation that harvested software credentials and built up a list of roughly 2.1 million email addresses; a second arrest over an investment fraud scheme promoted through messaging apps that moved more than $2.4 million, much of it laundered through cryptocurrency.
  • Republic of Congo: 30 suspects arrested in connection with a cybercrime operation.

This is the third wave of the Serengeti campaign, following operations in September–October 2024 and June–August 2025 that together produced more than 2,000 arrests.

Why it matters

Takedowns of this size are a reminder of two things. First, the crime behind most corporate losses is not exotic: phishing kits, credential theft, BEC and investment fraud remain the industrial base of cybercrime. Second, criminals need infrastructure — servers, domains, botnets, mailing lists — and that infrastructure leaves traces that defenders and investigators can follow.

Arrests disrupt operators, but they don't un-leak data. The 2.1 million harvested email addresses and the stolen software credentials linked to the Nigerian BEC case don't disappear when a suspect is detained; that kind of material is routinely copied, resold and reused by other groups. Organizations whose staff or customers were caught in these campaigns may keep seeing follow-on phishing and account-takeover attempts for months.

What to do

  • Assume your addresses are on someone's list. Train finance and executive teams to verify any payment-detail change or urgent transfer request through a second, known channel — the core defence against BEC.
  • Harden email authentication. Enforce SPF, DKIM and a DMARC policy of quarantine or reject so your domain is harder to spoof.
  • Rotate and protect credentials. Enforce phishing-resistant MFA (FIDO2/passkeys) on email, VPN and SaaS admin accounts, and reset credentials for any software accounts you suspect were exposed.
  • Watch for unusual mailbox rules and logins — forwarding rules, new OAuth app grants and sign-ins from unexpected geographies are classic BEC tells.
  • Brief staff on investment and "pension" scams delivered via messaging apps; these increasingly target employees personally, then pivot to the company.

Stolen credentials and harvested email lists tend to surface in criminal marketplaces long before they are used. That is exactly what our Deep/Dark Web monitoring service is built to catch: the 4Tify team tracks leak sites, forums and credential dumps for your domains and staff accounts, so you can reset access and warn people before a phishing or BEC campaign lands.

Source: reported by The Hacker News, based on INTERPOL's official announcement of Operation Serengeti III.

SHARE